Splunk Cybersecurity Defense Architect (SPLK-5003) Certification Sample Questions

01. Eighteen hours into a large-scale incident, a retailer's executives are pressing for a definitive statement on whether customer data has been taken. The investigation cannot yet answer that question. What should the incident communication say?
a) That no evidence of data theft has been found so far, which is the investigation's current position
b) The team's current working hypothesis, marked as provisional so the executives can plan against it
c) Nothing further until the investigation can answer the question that has been asked
d) What is established, what is still being determined, and when the next update will come

02. A security architect maps the organisation's capabilities across prevention, detection, response and recovery. The map shows heavy investment in prevention and detection and almost none in recovery. Why is this pattern a concern?
a) Detection capability cannot be effective unless recovery capability exists to act on what it finds
b) Prevention and detection will eventually fail, and recovery is what limits the damage when they do
c) Regulators increasingly expect organisations to demonstrate capability across all four functions
d) Investment concentrated in two functions suggests the capability map was applied unevenly, or that its categories were read differently by each team

03. A utility is writing its major security incident procedure. During a recent exercise, three managers each briefed a different version of events to different audiences and the executive team received contradictory accounts. Which provision addresses this directly?
a) A single incident commander who owns the authoritative account of the situation, with all external communication drawn from it
b) A requirement that all executive briefings be delivered in writing rather than verbally during an incident
c) A scheduled briefing cadence, so that executives, regulators and staff all receive updates at the same points during the incident
d) A rule that only the chief information security officer may brief the executive team and the wider business during a major incident

04. A regional insurance group subscribes to two commercial intelligence feeds and several open-source indicator lists. Analysts report that the large majority of matches concern sectors and technologies the group does not operate, and they have begun ignoring the queue.
What should govern which sources the programme keeps?
a) The renewal cost of each commercial feed measured against the open-source lists covering similar ground
b) The intelligence requirements the business has stated, against which each source's relevance can be judged and renewed
c) The share of each source's indicators that the platform can normalise into the threat framework without custom parsing or enrichment
d) Whether each source contributes enough indicator volume, since broader coverage lowers the chance of missing an emerging threat

05. An architect must decide which steps of an incident response workflow may run without human approval. The workflow can gather context, open a ticket, quarantine a file, disable an account and block a network range. Which principle should govern the split?
(Choose two.)
a) How long the action takes to execute once the workflow reaches it
b) How frequently the action is expected to be invoked across the estate
c) How reversible the action is if the triggering detection proves wrong
d) How wide the action's effect is beyond the entity that triggered it

06. A media company has onboarded eleven security tools over four years. Each was integrated directly with the SIEM by a separate project, and the SIEM's output now feeds several downstream consumers, each with its own tool-specific handling. Adding a twelfth tool now requires changes in six places.
Which integration strategy addresses the underlying problem?
a) Document the eleven existing integrations thoroughly so the pattern for the twelfth can be chosen from a known set
b) Define a common intake contract that every source conforms to, so integration happens once rather than once per consumer
c) Replace the eleven point integrations with scheduled bulk exports, so each tool writes a file, a manifest and a checksum that the platform collects on a fixed cycle
d) Assign all future tool integrations to a single central team, so the eleven existing patterns need not proliferate further

07. An architect is selecting where machine learning would add most value in a security programme whose principal difficulty is that analysts cannot read the volume of alerts produced each day. The programme will not close an alert without a person having seen it.
Which applications fit that difficulty?
(Choose two.)
a) Scoring each alert for severity so that the queue can be worked in priority order
b) Generating new detection content from published descriptions of attacker techniques
c) Automatically closing alerts the model assesses as benign so they never reach the queue
d) Grouping related alerts so the queue presents incidents rather than individual events

08. A security architect is reviewing a proposal to apply anomaly detection to server authentication logs. The environment includes a large batch processing estate whose service accounts authenticate in predictable daily bursts, and a development estate whose engineers work irregular hours across time zones.
Which observation should most shape the design?
a) Service account authentication is predictable enough that it should be excluded from anomaly detection entirely
b) Irregular working hours make the development estate unsuitable for anomaly detection on authentication data
c) The two populations have different normal behaviour, so a single baseline fits neither
d) Authentication logs alone lack the context needed for anomaly detection, so they must be enriched with asset, identity and location data first

09. An architect is selecting a small set of measures for a new security programme dashboard intended for business leadership. Which measures belong on it?
(Choose two.)
a) The time taken to detect and contain incidents
b) The percentage of staff who completed security awareness training
c) The proportion of the organisation's priority threats that have working detection coverage
d) The number of security alerts generated across the estate each week

10. A bank has added security scanning to every pipeline. Six months on, the scanners produce several thousand findings a week, teams have configured most pipelines to continue on failure, and no finding has been remediated in two months. What is the architectural failure?
a) The scanners selected are poorly tuned for the languages and frameworks in use at the bank
b) Controls were added without deciding which findings must block and who owns the rest
c) Teams were permitted to configure their own pipelines instead of using a centrally managed template
d) Scanning was placed in the pipeline rather than in the developer's environment where it belongs